crackthe.net
Protecting the WordPress login: two-factor sign-in, limits, and XML-RPC
How bots attack the WordPress login, the defenses WordPress itself recommends, two-factor sign-in and passkeys, XML-RPC, and application passwords.
Key points
- In a brute-force attack, a bot tries user names and passwords until one works. Its usual targets are the login page and XML-RPC.
- WordPress core has no two-factor sign-in. A plugin adds it, and passkeys need one more plugin.
- WordPress advises limiting login attempts at a firewall or on the web server, and turning off XML-RPC if nothing you use needs it.
How attacks on the login work
WordPress describes a brute-force attack as “the simplest way to break in”: an attacker tries user names and passwords until one works. Bots aim at two addresses that every WordPress site has:
- /wp-login.php, the normal login page.
- /xmlrpc.php, an older interface for apps. WordPress calls it “a frequent brute-force target,” especially through its method system.multicall.
The defenses WordPress recommends
| Defense | What it stops |
|---|---|
| Long, unique passwords from a password manager | guessing |
| Two-factor sign-in for every administrator | logins with a stolen or guessed password |
| Passkeys (WebAuthn) | phishing, because a passkey works only on the real site |
| Limiting login attempts at a firewall or on the web server | endless guessing |
| A CAPTCHA or Turnstile on the login | automated logins |
| Turning off XML-RPC, or limiting it | guessing through XML-RPC |
| No user named “admin” | the easiest guesses |
Two things WordPress does not count as real protection: moving the login page to another address “can reduce noise but should not be your only defense.” And it advises against blocking whole countries permanently.
Two-factor sign-in and passkeys
WordPress itself has no two-factor sign-in. The free plugin Two Factor, developed by the WordPress community and used on 100,000+ sites, adds three methods:
- codes from an authenticator app (TOTP),
- codes by email,
- backup codes for when you lose your phone.
For passkeys or security keys, it needs a second plugin, “Two-Factor Provider: WebAuthn.” Many security plugins offer two-factor sign-in as well.
Application passwords
Since WordPress 5.6 of December 2020, apps can connect to your site with application passwords instead of your real password. In your user profile, you see which apps are connected and can revoke them. Revoke every one you no longer use.
What you can do
- Turn on two-factor sign-in for every account with the role Administrator or Editor.
- Limit login attempts at your firewall, on the web server, or with a security plugin.
- Open example.com/xmlrpc.php on your site. If it says “XML-RPC server accepts POST requests only.”, the interface is on. Turn it off if no app or service of yours needs it.
- Check your users under Users. Delete accounts nobody uses, and make sure none is called “admin.”
- Review the application passwords in each administrator’s profile and revoke the unused ones.
Next step
The guide How do bots find WordPress sites? shows how bots learn your user names in the first place.
The figures in this guide come from the archive and change with every data update. As of November 13, 2026.
Check it with the archive's data
Read next: VPN tunnel and encryption: what is protected and what is notAll guides